Describe the issue
Firstly, running
checkov -f target.tf -o json --output-file-path result.json
The output is written to result.json/results_json.json and not directly to result.json. This isn't the case when we specify multiple output files
checkov -f target.tf -o cli -o json --output-file-path console,result.json)
or
checkov -f target.tf -o json --output-file-path result.json,
This behaviour is due to the logic requiring a mandatory , to recognize output file paths specified.
source file: /checkov/common/runners/runner_registry.py, function: print_reports, line causing the bug: 393
The second problem is,
Running
checkov -f target.tf -o json -o junitxml --output-file-path result.json
the output of both the formats is written under the same directory i.e it ignores the output_file_path due to the issue described above and then creates both result.json/results_json.json and result.json/results_junitxml.xml
This again happens due to the output_formats becoming an empty list(described in Additional Context)
This is an anomaly because, running
checkov -f target.tf -o json -o junitxml -o spdx --output-file-path result.json,result.xml,
leads to the json output being written to result.json and junitxml being written to result.xml and spdx to the console.
The last one related is the unwanted crash when using
checkov -f target.tf -o json -o junitxml --output-file-path result.json,
due to an empty string from split(",") in output_paths
source file: /checkov/common/runners/runner_registry.py, function: print_reports, line causing the bug: 395
This has the simplest fix of all i.e using
output_paths = [output_file.strip() for output_file in config.output_file_path.split(",") if output_file.strip()]
Additional context
The bug is due to using "console" (default) as the output_dest when a , is not detected in output_file_path and then subsequently the function _print_to_console performing del output_formats[output_format] which makes output_formats an empty list for single output_file_path usage. This causes the else logic in line 639 in the same print_reports function to execute even when a output_file_path was specified leading to the output being stored in OUTPUT_FILE_PATH/results_json.json and not in OUTPUT_FILE_PATH.
Clarification Required
Do you want commands like
checkov -f target.tf -o json -o junitxml --output-file-path result.json
to write the json output to result.json and junitxml content to the default file name in the directory in which the command is run
or
write json to result.json and print junitxml content to the console only.
The first and the third bugs are unambiguous but the second one requires a decision from your side.
Please let me know the expected behaviour when the number of output formats specified are more than the output file paths so that I can create a PR based on the requirement
It would also be great if you confirm that all the changes mentioned above can be put in a single PR
I have implemented the fixes and the required tests. Please let me know if you're happy with me proceeding and I'll create a PR.
Thanks.
Describe the issue
Firstly, running
checkov -f target.tf -o json --output-file-path result.jsonThe output is written to
result.json/results_json.jsonand not directly toresult.json. This isn't the case when we specify multiple output filescheckov -f target.tf -o cli -o json --output-file-path console,result.json)or
checkov -f target.tf -o json --output-file-path result.json,This behaviour is due to the logic requiring a mandatory
,to recognize output file paths specified.source file:
/checkov/common/runners/runner_registry.py, function:print_reports, line causing the bug:393The second problem is,
Running
checkov -f target.tf -o json -o junitxml --output-file-path result.jsonthe output of both the formats is written under the same directory i.e it ignores the output_file_path due to the issue described above and then creates both
result.json/results_json.jsonandresult.json/results_junitxml.xmlThis again happens due to the output_formats becoming an empty list(described in
Additional Context)This is an anomaly because, running
checkov -f target.tf -o json -o junitxml -o spdx --output-file-path result.json,result.xml,leads to the json output being written to result.json and junitxml being written to result.xml and spdx to the console.
The last one related is the unwanted crash when using
checkov -f target.tf -o json -o junitxml --output-file-path result.json,due to an empty string from split(",") in
output_pathssource file:
/checkov/common/runners/runner_registry.py, function:print_reports, line causing the bug:395This has the simplest fix of all i.e using
Additional context
The bug is due to using "console" (default) as the output_dest when a
,is not detected in output_file_path and then subsequently the function_print_to_consoleperformingdel output_formats[output_format]which makes output_formats an empty list for single output_file_path usage. This causes theelselogic in line639in the sameprint_reportsfunction to execute even when a output_file_path was specified leading to the output being stored inOUTPUT_FILE_PATH/results_json.jsonand not inOUTPUT_FILE_PATH.Clarification Required
Do you want commands like
checkov -f target.tf -o json -o junitxml --output-file-path result.jsonto write the json output to
result.jsonand junitxml content to the default file name in the directory in which the command is runor
write json to
result.jsonand print junitxml content to the console only.It would also be great if you confirm that all the changes mentioned above can be put in a single PR
I have implemented the fixes and the required tests. Please let me know if you're happy with me proceeding and I'll create a PR.
Thanks.